Sophos UTM 330

Question

is it possible to authenticate active directory user with firewall rule? so far unsuccessful

BAlfson · Answer

Yes you can, Brian. 
 First, you need to configure user identification as I described above. 
 Then, assuming that you're using Web Filtering now, make DNS Host definitions for the FQDNs you find with: 
 zgrep 'fbcdn\.net' /var/log/http/2020/*/*|grep -oP 'url=".*?"'|sort -n|uniq -c 
 And for: 
 zgrep 'url="https\://[A-Za-z0-9.-]*facebook\.com/' /var/log/http/2020/*/*|grep -oP 'url=".*?"'|sort -n|uniq -c 
 Because of [A-Za-z0-9.-]*, the second one will take awhile. 
 Now you can make a firewall rule like 
 {group of (User Network) objects} -> Web Surfing -> {group of Facebook DNS Hosts} : Drop 
 Cheers - Bob